Tags: alvacoder/ship-safe
Tags
feat(webapp): add supply chain security blog post and full documentat… …ion page - Blog: "From Trivy to CanisterWorm" research post covering the 2026 attack chain and Ship Safe's defenses - Docs: complete documentation page with sidebar nav covering all commands, agents, scoring, CI/CD, OWASP coverage, and config - Nav: add Docs link - Sitemap: add /docs route
feat: ship-safe v6.0.0 — new agents, commands, and bug fixes New features: - Exception Handler Agent (OWASP A10:2025): empty catch, unhandled rejections, missing error boundaries - Vibe Coding Agent: detects risky AI-generated code patterns - MCP Security expansion: typosquatting detection, over-permissioned tools, shadow MCP configs - EPSS risk prioritization: fetch exploit probability from FIRST.org API - Interactive HTML reports: severity filtering, search, collapsible rows, copy-to-clipboard - GitHub PR comment integration (--github-pr flag on ci command) - Auto-fix expansion: Actions SHA pinning, cookie security, Dockerfile USER, debug mode env vars - Vibe Check command: fun emoji security check with shareable badge - Benchmark command: compare score against OWASP/Synopsys/Snyk industry averages - Diff command: scan only changed files for fast pre-commit scanning - OWASP 2025 scoring rebalance Bug fixes: - Fix ESM require() crash in MCP agent shadow config detection - Fix agent count mismatch (18→17) in CLI descriptions - Fix 14 false positives: DEBUG=True in comments, MCP_STDIO on execFileSync, AGENT_ESCALATED on function names - Fix doctor semver comparison (5.0.1 no longer shown as newer than 5.2.0) - Fix floating-point noise in score display - Fix ReDoS vulnerability in JWT regex (catastrophic backtracking) - Fix broken DOCKER_RUN_AS_ROOT regex (replaced by whole-file check) - Tighten PII agent regexes to reduce false positives - Better secret masking for short values - Skip scanning ship-safe's own report files
feat: ship-safe v5.0.0 — 16 agents, LLM deep analysis, CI mode, CRA-r… …eady SBOM New agents (5): - MCP Security Agent: 19 patterns for MCP server vulnerabilities (OWASP ASI02/ASI03) - Agentic Security Agent: 18 patterns for AI agent risks (OWASP ASI01-ASI06) - RAG Security Agent: 14 patterns for vector DB poisoning, embedding attacks (LLM08) - PII Compliance Agent: 19 patterns for GDPR/CCPA compliance - Verifier Agent: heuristic post-processor that confirms or downgrades findings New features: - Deep LLM taint analysis (--deep): regex nominates, LLM confirms exploitability - Ollama support (--local): run deep analysis with local models - Budget control (--budget): cap LLM spend in cents - Secrets verification (--verify): probe provider APIs to check if leaked keys are active - CI/CD command (ship-safe ci): exit codes, SARIF output, severity gating, --threshold - Cross-agent awareness: sharedFindings lets agents see each other's results - Framework-aware scanning: shouldRun(recon) skips irrelevant agents - CRA-ready SBOM: supplier, licenses, lifecycles, vulnerability attachment - Vibe code detection: TODO auth, placeholder secrets, CRUD without auth - Supply chain behavioral signals: eval in install scripts, hex obfuscation, unused deps Claude Code plugin v3.0.0: - New skills: /ship-safe-deep, /ship-safe-ci - Updated all skills for 16 agents and 80+ attack classes 90 tests passing across 26 suites.